What your supervisor will ask for in 2027.

The direction is clear.

NIS2 makes management bodies approve and oversee cybersecurity risk measures, and names supply-chain security directly. DORA requires financial entities to keep a register of ICT third-party arrangements. These rules do not only ask for a policy. They ask you to show how it works in practice.

No one can tell you exactly what your supervisor will open with. These four questions are a good rehearsal.

1. What did you decide about this supplier?

Not what the policy says. What you decided about this one, on this date, including any conditions.

2. Who decided, and under which mandate?

A name, and the authority that person had. "The security team" won't hold up. Neither will an approval from someone who wasn't allowed to accept that level of risk.

3. On which facts, and how old were they?

Which certificate and which answers, and were they still valid on that date? A decision is only as good as the facts it rested on when it was made.

4. Can you prove it today?

Without a week of searching, and without relying on the memory of the person who has since moved on.

Try it this week.

Pick one critical supplier and answer all four. Time it. The result tells you more about your readiness than any maturity score.